How to set up passkeys for your Google and Microsoft accounts (and where Apple fits in)

Guide type

Step-by-step setup

Risk if skipped

Medium

Time

10–15 min

Cost

Free

Works on

Android 9+, iOS 16+, Windows 10+, macOS 13+

Last verified

2026-10-05

What a passkey is, in plain terms

A passkey replaces your password with the lock you already use on your phone or computer: your fingerprint, your face or your device PIN. Behind the scenes, your device holds a secret key that never leaves it, and the website only holds a matching public key that is useless to a thief.

Two things make passkeys much safer than passwords:

• They cannot be phished. A passkey only works on the real website it was made for. A fake login page gets nothing, which is why passkeys stop the attack described in our guide on what to do after clicking a phishing link.
• There is nothing to leak or reuse. When a company is breached, attackers do not get a password they can try elsewhere.

The trade-off: a passkey is only as safe as the device that holds it. If someone knows your phone's PIN and has your phone, they can use your passkeys. Use a PIN of at least six digits, not your birth year.

Before you start

You need	Why
A screen lock on your phone or computer (PIN, fingerprint or face)	The passkey is unlocked with it. No screen lock, no passkey.
A recent system: Android 9, iOS 16, Windows 10, macOS Ventura or newer	Older versions cannot create passkeys.
An up-to-date browser: Chrome, Safari, Edge or Firefox	Google lists Chrome 109, Safari 16, Edge 109 and Firefox 122 as the minimum.
On Apple devices: iCloud Keychain and two-factor authentication turned on	Apple stores passkeys in iCloud Keychain so they sync across your devices.
Your current password and access to your phone	Both services ask you to confirm it is you before adding a new sign-in method.

Set up a passkey for your Google Account

1. Open the passkeys page

   On the phone or computer you use most, go to myaccount.google.com/signinoptions/passkeys. You can also get there from your Google Account: Security & sign-in › Passkeys and security keys. Sign in if asked.

2. Create the passkey

   Tap Create a passkey, confirm, then unlock your device with your fingerprint, face or PIN. On an iPhone or Mac, the passkey is saved to iCloud Keychain; on Android, to Google Password Manager; on Windows, to Windows Hello or the password manager your browser offers.

3. Check the list

   The new passkey appears on the same page with the device or manager it lives in. Android phones signed in to your Google Account may already show a passkey that Google created automatically. That is normal.

4. Decide whether to skip the password

   After you add a passkey, Google turns on Skip password when possible, so you are asked for the passkey first. Leave it on unless you have a reason not to. Your password still works as a fallback.

5. Add a second passkey on another device

   Repeat steps 1 and 2 on a second device, such as your laptop or a tablet, or use Use another device to save one on a hardware security key. Two passkeys on two devices means losing one does not lock you out.

Set up a passkey for your Microsoft account

This is for personal Microsoft accounts (Outlook.com, Hotmail, Xbox, Microsoft 365 Personal or Family). Work and school accounts are managed by your organisation.

1. Open Advanced security options

   Go to account.live.com/proofs/manage, or open account.microsoft.com/security and choose Advanced security options. Confirm your identity if asked.

2. Add a new sign-in method

   Choose Add a new way to sign in or verify, then Face, Fingerprint, PIN, or Security Key.

3. Pick where to save it

   Select Continue or Create to save it where your device suggests (Windows Hello on a PC, iCloud Keychain on Apple devices, Google Password Manager on Android), or Save another way to use your phone, a security key or another password manager. Unlock your device to finish.

4. Leave your password in place for now

   Microsoft lets you remove the password from your account entirely. Only consider it once you have at least two working passkeys or the Microsoft Authenticator app set up, plus an up-to-date recovery email or phone.

Where Apple fits in

On iPhone, iPad and Mac, passkeys are stored in the Passwords app and synced through iCloud Keychain to every device signed in to the same Apple Account. When a website or app offers to create a passkey, your device shows a prompt; tap Continue and confirm with Face ID or Touch ID. That is how you save the Google and Microsoft passkeys above on an Apple device.

Your Apple Account itself does not have an "add passkey" button. It is already protected by two-factor authentication tied to your trusted devices, and on recent versions of iOS and macOS you can sign in to Apple's websites by confirming on your iPhone or Mac. What matters for your Apple Account is that two-factor authentication is on and your trusted phone number is current: check it in Settings › your name › Sign-In & Security.

Where should your passkeys live?

Option	Good for	Watch out for
Your phone's built-in manager (iCloud Keychain or Google Password Manager)	Most people. Free, syncs across your devices from the same company.	Mixing iPhone and Windows or Android means some sign-ins need a QR code scan with your phone.
A cross-platform password manager	People who use Apple, Windows and Android together.	The manager's own main password and recovery become critical. Protect them well.
Windows Hello (only on that PC)	A second passkey on your main computer.	Does not sync. If the PC dies, so does that passkey.
A hardware security key	Backup passkey, high-risk accounts, small business admins.	Costs money and can be lost. Buy two and register both.

The lockout-proof checklist

Most passkey horror stories are really "my only device broke" stories. Before you close this page, make sure you can tick at least two of these for each account:

• A passkey on a second device or a security key.
• A current recovery phone number and recovery email (Google: Security page; Microsoft: Advanced security options).
• Backup codes printed or saved offline (Google: 2-Step Verification › Backup codes; Microsoft: Recovery code in Advanced security options).
• Your password still works and is stored in a password manager.

Common questions

What happens if I lose my phone?

If your passkeys sync (iCloud Keychain or Google Password Manager), they come back when you sign in on a new phone. If you also have a passkey on your laptop or a security key, use that to sign in and remove the lost phone's passkey from the account's list.

Can Google or Apple see my fingerprint?

No. Your fingerprint or face only unlocks the passkey on your device. It is never sent to the website.

Do I still need two-step verification?

A passkey already combines two factors: something you have (the device) and something you are or know (biometrics or PIN). Keep two-step verification on anyway, because it still protects the password that remains on the account.

Is this worth it for a small team?

Yes, especially for email and admin accounts. It is one of the highest-value items in our small business cybersecurity checklist, because it removes the stolen-password route that most account takeovers use.

Sources

• Google — Sign in with a passkey instead of a password
• Microsoft — Create and save a passkey
• Apple — Use passkeys to sign in to websites and apps on iPhone
• Apple — About the security of passkeys
• FIDO Alliance — Passkeys
• CISA — Turn on multifactor authentication